test22221@2.2.7

Analysis

Package test22221@2.2.7 contains no executable code — only a package.json with malicious lifecycle hooks. On npm install, both the preinstall and postinstall scripts execute a curl command to IP 54[.]37[.]234[.]136 that exfiltrates the installer's username, hostname, and current working directory to the path /voicemail, and also fetches a second-stage value from hxxp://54[.]37[.]234[.]136/x123. The output is discarded to /dev/null to hide the activity. The package has no repository, no license, and no functional code — its sole purpose is to collect system metadata from anyone who installs it.